rotating audit logs
Bill Tangren
bjt at aa.usno.navy.mil
Tue Feb 13 16:16:55 UTC 2007
Steve Grubb wrote:
> On Tuesday 13 February 2007 10:31, Bill Tangren wrote:
>> Is is possible to have the auditd daemon rotate the logs according to time,
>> rather than size?
>
> There is a log rotation script suitable for cron usage in the audit package.
> You just simply need to add it to your cron setup.
OK, I've found the auditd.cron file. How do I prevent auditd from rotating by
size? Set the maximum size too high to be reached in a day?
>
>> If auditd cannot do this, is it possible to turn off log rotating and let
>> the logrotate daemon do it?
>
> You could do that too, but you'll have to teach logrotate about the audit
> logs.
I've taught logrotate about other logs, so I don't see that as a problem. How to
tell auditd not to rotate, though, that I DON'T know how to do.
>
> -Steve
>
More information about the Linux-audit
mailing list